Commit e8518f84 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Check EVP_DigestInit return value in EVP_BytesToKey() and use supported 

algorithm in PKCS12_create in FIPS mode.
parent 8299069b

crypto/evp/evp_key.c

+2 −1
Original line number Diff line number Diff line
@@ -126,7 +126,8 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md, 
	EVP_MD_CTX_init(&c);

	for (;;)

		{

		EVP_DigestInit_ex(&c,md, NULL);

		if (!EVP_DigestInit_ex(&c,md, NULL))

			return 0;

		if (addmd++)

			EVP_DigestUpdate(&c,&(md_buf[0]),mds);

		EVP_DigestUpdate(&c,data,datal);

crypto/pkcs12/p12_crt.c

+9 −1
Original line number Diff line number Diff line
@@ -76,7 +76,15 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, 
	unsigned int keyidlen;



	/* Set defaults */

	if(!nid_cert) nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;

	if(!nid_cert)

		{

#ifdef OPENSSL_FIPS

		if (FIPS_mode())

			nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;

		else

#endif

			nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;

		}

	if(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;

	if(!iter) iter = PKCS12_DEFAULT_ITER;

	if(!mac_iter) mac_iter = 1;